Secondary operator integration with a cellular network

ABSTRACT

Various arrangements for operating a cellular network with advanced secondary operator privacy are presented herein. A first set of user equipment may communicate using a first radio unit and a first radio spectrum with a cellular network. A second set of user equipment may communicate with the cellular network using a second radio unit and a second radio spectrum. The second radio unit may be operated by a secondary operator distinct from the cellular network operator. The second radio unit may encrypt the second communications such that the cellular network cannot decrypt the second communications. The cellular network, can route the encrypted second communications of the second cellular network slice from the second radio unit to a data center operated by the secondary operator separate and distinct from the cellular network.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to U.S. Provisional Patent ApplicationNo. 63/104,981, filed on Oct. 23, 2020, entitled “Dynamic SpectrumSharing,” the disclosure of which is hereby incorporated by reference inits entirety for all purposes.

This application is related to U.S. patent application Ser. No.17/192,182, entitled “Dynamic Cellular Network Spectrum Sharing,” filedon this same day as this application, the disclosure of which is herebyincorporated by reference in its entirety for all purposes.

BACKGROUND

On 4G Long Term Evolution (LTE) cellular networks and earlier generationcellular networks, allocating a defined amount of network resources toparticular entities or groups of user equipment was difficult. However,with later-generation cellular networks, such as 5G New Radio (NR)cellular networks, network slices may be defined. A network slice caneffectively function as a virtual network that has its own logicaltopology, security rules, and performance characteristics that functionwithin the limits of the underlying physical network.

SUMMARY

Various embodiments are described related to a cellular network withadvanced secondary operator privacy. In some embodiments, a cellularnetwork with advanced secondary operator privacy is described. Thenetwork may comprise a first radio unit that may communicate with afirst plurality of user equipment using a first radio spectrum. Firstcommunications between the first radio unit and a cellular network maybe performed as part of a first cellular network slice. The first radiounit may be operated by a cellular network operator. The network maycomprise a second radio unit that may communicate with a secondplurality of user equipment using a second radio spectrum. The secondradio unit may be operated by a secondary operator distinct from thecellular network operator. Second communications between the secondradio unit and the cellular network may be performed as part of a secondcellular network slice. The second radio unit may encrypt the secondcommunications such that the cellular network cannot decrypt the secondcommunications. The network may comprise a cellular access network ofthe cellular network that may route the second communications performedas part of the second cellular network slice as encrypted by the secondradio unit to a data center operated by the secondary operator andseparate from the cellular network.

Embodiments of such a network may include one or more of the followingfeatures: a distributed unit (DU) of the cellular access network thatmay be in communication with the first radio unit and the second radiounit. The DU may be operated by the cellular network operator. The DUmay route the first communications and the second communications to acentralized unit (CU) of the cellular network. The CU may be operated bythe cellular network operator. The CU may route the secondcommunications to the data center of the secondary operator that may beseparate and distinct from the cellular network. The second radio unitmay further send third communications between the second radio unit andthe cellular network as part of a third cellular network slice. Thecellular network may route the second communications and the thirdcommunications to separate components of a same network that may bedistinct from the cellular network and operated by the secondaryoperator. The DU may route the first communications to a CU of thecellular network operated by the cellular network operator and thesecond communications to the data center that may be operated by thesecondary operator and may be separate from the cellular network. Thecellular network may comprise a 5G New Radio (NR) cellular core network.The network may further comprise user equipment of the second pluralityof user equipment. The user equipment of the second plurality of userequipment may be configured to be switched between communicating withthe first radio unit and the second radio unit based on a command. Thefirst radio unit may use a different cellular network radio accesstechnology (RAT) for communication with the first plurality of userequipment than the second radio unit with the second plurality of userequipment.

In some embodiments, a method for operating a cellular network withadvanced secondary operator privacy is described. The method maycomprise communicating with a first set of user equipment using a firstradio unit and a first radio spectrum. First communications between thefirst radio unit and a cellular network may be performed as part of afirst cellular network slice. The first radio unit may be operated by acellular network operator. The method may comprise communicating with asecond set of user equipment using a second radio unit and a secondradio spectrum. The second radio unit may be operated by a secondaryoperator distinct from the cellular network operator. Secondcommunications between the second radio unit and the cellular networkmay be performed as part of a second cellular network slice. The secondradio unit may encrypt the second communications such that the cellularnetwork cannot decrypt the second communications. The method maycomprise routing, by the cellular network, the encrypted secondcommunications of the second cellular network slice from the secondradio unit to a data center operated by the secondary operator. The datacenter may be separate from the cellular network.

Embodiments of such a method may include one or more of the followingfeatures: the first communications and the encrypted secondcommunications may be routed through a distributed unit (DU) that is incommunication with the first radio unit and the second radio unit. TheDU may be operated by the cellular network operator. The method mayfurther comprise routing, by the DU, the first communications and thesecond communications to a centralized unit (CU) of the cellularnetwork. The CU may be operated by the cellular network operator. Themethod may further comprise routing, by the CU, the secondcommunications to the data center of the secondary operator that may beseparate and distinct from the cellular network. The method may furthercomprise sending, by the second radio unit, third communications as partof a third cellular network slice on the cellular network. The methodmay further comprise routing, by the cellular network, the secondcommunications and the third communications to separate components of asame network that may be distinct from the cellular network and operatedby the secondary operator. The method may further comprise routing, bythe DU, the first communications to a CU of the cellular networkoperated by the cellular network operator and the second communicationsto the data center that may be operated by the secondary operator andmay be separate from the cellular network. The cellular network may be a5G New Radio (NR) cellular network. The method may further compriseswitching, by user equipment of the second plurality of user equipment,between communicating with the first radio unit and the second radiounit based on a command. The first radio unit may use a differentcellular network radio access technology (RAT) for communication withthe first plurality of user equipment than the second radio unit withthe second plurality of user equipment.

BRIEF DESCRIPTION OF THE DRAWINGS

A further understanding of the nature and advantages of variousembodiments may be realized by reference to the following figures. Inthe appended figures, similar components or features may have the samereference label. Further, various components of the same type may bedistinguished by following the reference label by a dash and a secondlabel that distinguishes among the similar components. If only the firstreference label is used in the specification, the description isapplicable to any one of the similar components having the same firstreference label irrespective of the second reference label.

FIG. 1 illustrates a block diagram of an embodiment of a cellularnetwork.

FIG. 2 illustrates a block diagram of an embodiment of a cellularnetwork with advanced secondary operator control.

FIG. 3 illustrates a block diagram of another embodiment of a cellularnetwork with advanced secondary operator control.

FIG. 4 illustrates an embodiment of a method for operating a cellularnetwork with advanced secondary operator control.

FIG. 5 illustrates an embodiment of a method for operating a cellularnetwork using dynamic secondary spectrum sharing.

FIG. 6 illustrates an embodiment of a method for operating a cellularnetwork with advanced secondary operator control on multiple cellularnetwork slices.

DETAILED DESCRIPTION

Using cellular network slicing, a secondary operator, which is distinctfrom the network operator of the cellular network, can have autonomy tocontrol a defined cellular network slice. As detailed herein, asecondary operator can use a dedicated radio unit (RU) that communicatesvia components of the network operator's cellular network in order tocommunicate with the secondary operator's network. Such an arrangementcan allow the secondary operator autonomy to effectively operate a(virtual) cellular network without having to fully build out its owncellular network.

By using a dedicated RU, the secondary operator is afforded significantautonomy on how the secondary operator operates its network slice. Asone possible example, the dedicated RU can perform upstream (from UE tothe cellular network) payload encryption and/or downstream (from thecellular network to the UE) decryption. When communications are routedto the secondary operator's network and the secondary operator's RU viathe cellular network, the communications may remain encrypted except tothe extent needed for data routing. Therefore, none of the data of thesecondary operator may be exposed on the cellular network or to theoperator of the cellular network. Further, the cellular network does noteven need to be aware of the type of encryption or scrambling used onthe secondary operator's payloads because encryption and decryption arehandled by the secondary operator's network and either the secondaryoperator's RUs or UE.

Such an arrangement can be particularly useful for a secondary operatorrequiring a high level of security or privacy. As an example, themilitary may desire to have its own virtual cellular network withouthaving to build out a complete cellular network. The military, in areaswhere desired, could install RUs that use various components, asdetailed herein, of a commercial operator's cellular network. Themilitary could have a defined cellular network slice for whichcommunications performed using the cellular network slice are routedbetween the military's network by the cellular network and themilitary's RU. The military's network could fully manage prioritizationof UE, bandwidth allocation of UE, cellular services provided,encryption, and UE configuration within the military's dedicatedcellular network slice.

In some embodiments, an RU operated by a secondary operator may be usedin conjunction with two (or more) cellular network slices. Depending onthe particular cellular network slice being used for communication witha UE, the cellular network of the cellular network operator may routethe data differently to the secondary operator's network. The secondaryoperator may further be permitted to manage its UE as to which cellularnetwork slice the UE is assigned. For example, one cellular networkslice may be used for ultra-secure communications, while a secondcellular network slice is used for relatively less securecommunications. Additionally or alternatively, the UE could connect to acellular network slice operated by the cellular network operator. Theinstruction to use this cellular network slice may be made by anoperator of the UE or a command may be sent to the UE by the secondaryoperator's network.

In some situations, the secondary operator may not need to use all ofthe spectrum and/or bandwidth of the cellular network slice allocated tothe secondary operator for a given geographical region at a particulartime. The secondary operator may temporarily release resources, such asspectrum, bandwidth, and/or processing resources, for permissible use byanother cellular network slice. For example, a secondary operator mayhave the rights to particular spectrum for a given region. When thesecondary operator does not need the spectrum, the secondary operator'snetwork may send an instruction to the cellular network of the cellularnetwork operator that indicates that the spectrum is at leasttemporarily available for use. While available, the cellular networkoperator may alter bandwidth part (BWP) definitions (or the active BWPdefinitions) used for a cellular network slice it operates to takeadvantage of the spectrum available from the secondary operator. Whenthe secondary operator reclaims the spectrum, the cellular networkoperator may again alter BWP definitions or the active BWP profile forUE such that the spectrum is again reserved for the secondary operator.Such an arrangement call allows for a secondary operator to maintain theability to use its reserved spectrum and/or bandwidth, but allows thespectrum and/or bandwidth to be used by another operator when it is notneeded by the secondary operator.

Further detail regarding these and other embodiments are presented inrelation to the figures. FIG. 1 illustrates a block diagram of anembodiment of a cellular network system 100. Cellular network system 100can be operated by a cellular network operator (also referred to as acellular network provider). The cellular network operator may be acommercial entity that allows subscribers to access the cellular networkusing UE in exchange for a subscription or on a fixed-fee basis.Cellular network 110 can include both a cellular access network and acellular core network. Cellular network 110 can include: national datacenter (NDC) 115; central units (CUs) 120; distributed units (DUs) 125;and radio units (RUs) 130. The cellular access network can be defined asincluding the RUs 130, DUs, 125, and CUs 120. The cellular core networkcan be defined as including NDC 115. The Cellular network 110 canrepresent a 5G New Radio (NR) cellular network or, more specifically, a“stand-alone” 5G cellular network. Therefore, the cellular core networkcan be a 5G core (5GC) network. Cellular network 110 may operateaccording to the Open Radio Access Network (O-RAN) cloud-nativearchitecture that allows for mobile front-haul, mid-haul, and back-haulto be performed using cloud-computing principles. Therefore, rather thanusing specialized hardware to perform access network and core networkfunctionality, more generalized purpose server systems operatingspecialized software or firmware are used to perform the functions ofcellular network 110. Additionally or alternatively, cellular network110 may be native 5G in accordance with 3GPP 5G standards.

An RU, such as RU 130-1, serves as the interface between cellularnetwork 110 and wireless radio-based communications with UE 140. RU130-1 handles transmitting and receiving wireless communications with UE140 via one or more antennas located on tower 135-1. RU 130-1 can belocated on or nearby tower 135-1. RU 130-1 handles transmitting andreceiving data according to a particular wireless communicationprotocol, such as 3G, 4G LTE, 5G NR, or some future technology, such as6G or beyond. As illustrated in FIG. 1 , RU 130-1 is connected with oneor more antennas located on tower 135-1 and currently communicates withUE 140. Cellular network traffic for UE 140 may occur on a particularcellular network slice between RU 130-1 and DU 125-1. RU 130-2communicates with other UE via one or more antennas on tower 135-2. Insome embodiments, structures other than towers, such as buildings andbridges, may be used for mounting antennas. Group 141 indicates that UE140 communicate using a single cellular network slice on cellularnetwork 110.

Multiple RUs may communicate with a single DU, such as DU 125-1. A DU,such as DU 125-1, functions as a logical node of the cellular networkbetween RUs and a CU, such as CU 120-1. DU 125-1 can perform variousfunctions, which may be customized based on the specific cellularnetwork. For example, DU 125-1 may operate the Radio Link Control (RLC)layer, Medium Access Control (MAC) layer, and aspects of the physical(PHY) layer in conjunction with the connected DUs and CU. DU 125-2 mayalso communicate with CU 120-1. Notably, the multiple RUs thatcommunicate with a single DU may be made by different manufacturers.Since the cellular network operates according to 0-RAN, the cellularnetwork can tolerate different make/model of RUs; therefore, thesecondary operator is not restricted to using a particular make/model ofRU.

CU 120-1 may serve to operate different layers than DUs 125. Again, thespecific functions and layers handed by CUs 120 can be customized basedon the specific cellular network. For example, CUs 120 may operate theRadio Resource Control (RRC) layer and Packet Data Convergence Protocol(PDCP) layers. Viewed another way, a gNodeB can include a CU and atleast one DU. A CU can also be referred to as a local data center ofcellular network 110. In the hierarchy of a cellular network, a CU maysit between DUs 125 and a national or centralized data center. RUs 130,DUs 125, and CUs, 120 may be connected using high-speed fiber opticcommunications.

CUs 120 may communicate with NDC 115 of cellular network 110. Dependingon the architecture of cellular network 110, various other networks,such as the Internet 117 and/or network 119, which may be some otherpublic or private network, may be accessed via NDC 115. In otherembodiments, such networks may be accessible via CUs 120 and/or DUs 125.

UE 140 can represent various forms of devices that can communicate usingthe cellular network. For example, smartphones, cellular modems,wireless sensor devices, access points (APs) and gaming devices mayfunction as UE 140. Collectively, UE 140 may be assigned to a particularcellular network slice. Therefore, front haul (data transmission betweenRUs 130 and DU 125), midhaul (data transmission between DU 125 and CU120) and backhaul (data transmission between CU 120 and NDC 115) may beperformed by cellular network 110 using the cellular network slice towhich UE 140 are assigned. If any other cellular network slice ispresent, those physical resources may be reserved for UE associated withthe other cellular network slice.

FIG. 1 illustrates a simplified embodiment of a cellular network. Itshould be understood that in practice a significantly more expansivenetwork can be present with a greater number of towers, RUs 130, DUs125, and CUs 120. The cellular network can be a native 5G NR cellularnetwork that uses both 5G NR for communication with UE and for cellularnetwork 110. However, other cellular technologies may be possible.

While FIG. 1 illustrates a cellular network operated by a singlecellular network operator, FIG. 2 illustrates a secondary operator thatrelies on the cellular network operator's access and/or core network forat least some functionality and communication. FIG. 2 illustrates ablock diagram of an embodiment of a cellular network 200 with advancedsecondary operator control. Cellular network 200 is an embodiment ofcellular network system 100 on which a secondary operator is assigned acellular network slice on the cellular network.

On cellular network 200, a secondary operator maintains its own RU 230and other network components as part of secondary operator network 211,such as local data center (LDC) 210 and national data center (NDC) 205.Notably, the secondary operator does not operate all componentsnecessary to operate an independent cellular network. In the illustratedembodiment of FIG. 2 , the secondary operator does not operate its ownDUs or CUs.

While the secondary operator does not operate its own DUs or CUs in theembodiment illustrated in FIG. 2 , the secondary operator maintains fulloperational control of LDC 210, NDC 205, and RU 230, which are parts ofsecondary operator network 211. By having control of its own RU 230, thesecondary operator has control over UE prioritization, radio accesstechnology (RAT), bandwidth allocations, BWP definitions on itsspectrum, encryption of data, and more, as discussed below.

LDC 210 of the secondary operator may communicate (e.g., via a fiberoptic link) with a component of the cellular network operator's cellularnetwork. To be clear, the secondary operator and the cellular networkoperator are distinct entities. For example, the cellular networkoperator may be a commercial entity and the secondary operator may be aseparate commercial entity (e.g., a casino) or a governmental entity(e.g., the military). In the embodiment of FIG. 2 , LDC 210 communicateswith CU 120-1. The secondary operator has a designated cellular networkslice on cellular network 110. Therefore, a particular amount ofphysical communication and processing resources of cellular network 110may be reserved for the secondary operator. The secondary operator cancollate, manage, interpret operational and security logs on itsdesignated network slice. By the secondary operator having a designatednetwork slice, advanced analysis on its communication traffic may beperformed, including artificial intelligence (AI)—bases analyses,including behavioral pattern analyses. On the secondary operator'scellular network slice, the secondary operator can perform varioussecurity controls particular to the secondary operator including, butnot limited to: UE protection; denial of service (DoS) protection;identify and access management; behavioral anomaly detection; endpointprotection; certification lifecycle management; firewalls/gateways;container security; zero trust architecture; mutual authentication;management of network function communications; and integrated securityincident and event management platforms.

RU 230 may be installed, maintained, and/or configured by the secondaryoperator. RU 230 may be installed on a same tower or structure as RU130-1 or on a different tower or structure. RU 230 may be capable ofcommunicating on different frequencies than RU 130-1. In someembodiments, at least some of the frequencies that RU 230 uses forcommunication with UE are the same as frequencies on which RU 130-1 cancommunication with UE 140. RU 230 communicates with UE 240 that areassociated with the secondary operator. The secondary operator, via RU230 and LDC 210, has full operational control on authentication of UE240 for accessing the network of the secondary operator.

Via RU 230, NDC 205 and/or LDC 210 of the secondary operator can be usedto configure characteristics of how communications with UE 240 arehandled. Specifically, the secondary operator can control the priorityof each of UE 240, the amount of bandwidth allocated to each of UE 240,and/or the cellular services provided to each of UE 240. The secondaryoperator can control and optimize the use of the radio resourcesallocated to UE 240 based on the services supported and optimized foreach application enabled by the secondary operator. The optimization cantake into account any number of variables, including but limited to theapplication performance, the time of day, and the geographic location ofUE 240.

Notably, RU 230 of the secondary operator cannot communicate directlywith LDC 210. Rather, the secondary operator at least partially relieson the cellular network operator's access network and/or core network.RU 230 communicates with DU 125-1, which in turn communicates with CU120-1. DU 125-1 and CU 120-1 may provide the appropriate processing andmanagement of data needed for RU 230 similar to that provided for RU130-1. However, by virtue of UE 240 operating as part of a secondcellular network slice (as indicated by group 241), which is distinctfrom the cellular network slice used by the cellular network to servicegroup 141, CU 120-1 routes all cellular network traffic attributed tothese UE to LDC 210.

The packet-based communications between RU 230, DU 125-1, and CU 120-1for UE that operate as part of group 241 that are assigned to a secondcellular network slice may be partially encrypted. Data and/or voiceinformation may be encrypted/decrypted by UE 240 and/or may beencrypted/decrypted by RU 230. Neither DU, CU, or any other component ofcellular network 110 may be capable of decrypting this information. RU230 may leave addressing and/or other information besides data payloadsunencrypted to allow for routing by cellular network of the encrypteddata to LDC 210. LDC 210 and/or NDC 205 may be configured to perform theencryption/decryption. Therefore, data of the secondary operator canremain encrypted while being transmitted and, to some degree, processedby cellular network 110. Arrow 245 represents that data payloads can betransmitted in an encrypted form between RU 230 and LDC 210 withoutdecryption. In other embodiments, data payloads can be transmitted in anencrypted form between LDC 210 and UE 240 as part of a cellular networkslice without intervening decryption.

Not only is end-to-end encryption possible between RU 230 (or UE 240)and LDC 210, but the specific radio access technology (RAT) used by RU230 remains independent of RU 130 and the remainder of cellular network110. Therefore, the secondary operator could independently use GSM, 3G,4G LTE, 5G NR, 6G, or some other or future RAT that differs from the RATwhich is being used by RU 130-1 and the remainder of cellular network110.

As illustrated, CU 120-1 communicates with LDC 210. This architecture isshown as an example. One or more connections may additionally oralternatively be presented between NDC 115 and NDC 205, or between DU125-1 and LDC 210.

The secondary operator may have a dedicated cellular network slice oncellular network 110 such that a defined amount of hardware resources ofDUs 125 and CUs 120 and/or communication resources between DUs 125 andCUs 120 are reserved for the secondary operator. When suchprocessing/network resources are not needed, the resources may bereleased back to cellular network 110 to be used for one or more othercellular network slices. For instance, if the secondary operator is themilitary, it may only require full use of its cellular network sliceoccasionally. When not needed, the processing/network resources may beused by the cellular network operator to improve performance for itscommercial customers. In some embodiments, a specific instruction or“lease” on the reserved hardware resources of the secondary operator'scellular network slice is required to be received by cellular network110 from the secondary operator in order to permit use of the resourcesin conjunction with another cellular network slice.

Additionally or alternatively, spectrum reserved for use by RU 230 maybe released by the secondary operator when not needed. This spectrum maybe used by RU 130-1 of the cellular network operator for commercial use.NDC 205 or LDC 210 may provide a lease on spectrum to a component ofcellular network 110 for spectrum that is not needed by RU 230.(Notably, in another geographic region away from RU 230, the secondaryoperator may still be using this spectrum.) The cellular network maythen be permitted to use this spectrum, such as for up to a time periodindicated in the lease. RU 130-1 may send bandwidth part (BWP)definitions to UE 140 that indicates spectrum made available via thelease. In some embodiments, LDC 210 and/or NDC 205 are permitted toreclaim (or cancel the lease) at any time.

In some embodiments, additional cellular network components may beoperated by the secondary operator. For example, in addition to RU 230,the secondary operator may maintain its own DU. Communication trafficrelated to the secondary operator's cellular network slice may beprocessed using the secondary operator's DU instead of DU 125-1. Thesecondary operator's DU may remain in communication with CU 120-1 andmay still rely on CU 120-1 for interfacing with components of thesecondary operator's network. Therefore, for example, if the secondaryoperator used its own DU, it could rely on the cellular networkoperator's cellular network for mid-haul and backhaul functions.

While additional components of the secondary operator's network is notillustrated, it should be understood that routing and transmission ofcommunications from UE 240 may extend beyond LDC 210 and/or NDC 205. Forinstance, communications with a UE of UE 240 may be routed to another UEof the secondary operator that is in communication with LDC 210 or NDC205 via another CU, DU, or RU. Further, LDC 210 and/or NDC 205 may beconnected with public (e.g., the Internet) or private networks withwhich UE 240 may exchange data.

FIG. 3 illustrates a block diagram of another embodiment of a cellularnetwork 300 with advanced secondary operator control. Cellular network300 can represent a more detailed embodiment of cellular network 200. Oncellular network 300, RU 230, which is operated by the secondaryoperator, services two cellular network slices. While each of thesecellular network slices belongs to the secondary operator, cellularnetwork 110 handles each cellular network slice independently anddifferently. While group 241 represents that UE 240-1, 240-3, and 342operate on a first cellular network slice of the secondary operator,group 341 represents that UE 340 operate on a second cellular networkslice of the secondary operator. Each of these cellular network slicesmay be associated with different amounts of bandwidth and processingresources of cellular network 110 (or the slices may be assigned equalshares of the available physical resources).

By virtue of group 241 being on the first cellular network slice of thesecondary operator, cellular network 110 routes communicationsdifferently. Arrow 245 represents that upstream and downstreamcommunications for the first cellular network slice get routed betweenRU 230 of the secondary operator and LDC 210 via DU 125-1. In contrast,the second cellular network slice is routed differently: arrow 345represents that upstream and downstream communications for the secondcellular network slice get routed between RU 230 of the secondaryoperator and NDC 205 via DU 125-1, CU 120-1, and NDC 115. These twopossible routes are merely examples of how different cellular networkslices of the secondary operator can be routed to different portions ofthe secondary operator's network via various nodes of the cellularnetwork operated by the cellular network provider.

In addition to being routed differently, other characteristics of thefirst and second cellular network slices can be managed by the secondaryoperator differently. Different types of encryption can be used for thefirst and second cellular network slices. While on one of the cellularnetwork slices encryption/decryption may be handled by the UE, on theother cellular network slice, encryption/decryption may be handled by RU230.

NDC 205 is illustrated in FIG. 3 as serving as a gateway to network 319and Internet 117. UE may be assigned to the second cellular networkslice on the basis of UE 340 being used to access Internet 117 and/ornetwork 319.

If a UE has the capability to communicate on spectrum used by RU 130-1and RU 230, the UE may be permitted to switch between using one of thecellular network slices of the secondary operator and a cellular networkslice of the cellular network operator. As an example, a UE used by themilitary may be switched to a cellular network slice of the cellularnetwork operator, such as when being used for non-military purposes orif the cellular network slice of the secondary operator is experiencinghigh traffic. Further, UE that are capable of communicating usingspectrum used by RU 230, RU 130-1, and other RU of the cellular networkoperator may be able to roam in geographic regions where the secondaryoperator does not have a RU installed. Therefore, while the UE may usethe secondary operator's RUs when available, roaming across the cellularnetwork operator's network may be possible.

Further, while in a particular geographic region, the secondary operatormay have spectrum reserved for its use and may have one or more RUsinstalled that can utilize such spectrum for communication with UE,other factors may necessitate that the spectrum not be used forcommunication between the UE and RU 230. For example, the secondaryoperator may operate radar that uses at least some of the spectrum.Contemporaneous use of the spectrum for communication with UE may not bepossible due to interference generated by the radar. Therefore, in orderto communicate, the UE may switch to communicating with RU 130-1, whichuses different spectrum.

Multimode UE 342 represents a UE that can operate on spectrum used byboth RU 130-1 and RU 230. In response to a command from a user (e.g.,flipping a switch or some other physical actuation, providing a softwarecommand), multimode UE 342 may transition from functioning as part ofgroup 241 using the first cellular network slice of the secondaryoperator to functioning as part of group 141 using a cellular networkslice of the cellular network operator. In some embodiments, rather thanthe user of multimode UE 342 making the change, a command may bereceived from LDC 210, NDC 205, or some other component of the secondaryoperator's network. In some embodiments, LDC 210, NDC 205 or some othercomponent of the secondary operator's network may monitor performance ofeach of the secondary operator's cellular network slices. One or more UEmay be transitioned to a cellular network slice of the cellular networkprovider when a threshold amount of RF spectrum, bandwidth, orprocessing capabilities of one (or more) of the secondary operator'scellular network slice is being used. This may involve a command beingsent to the UE (e.g., multimode UE 342) that alters characteristics,such as the BWP definition active at the UE. Via the cellular networkprovider's network, the secondary operator may be able to continue tosend commands to the UE, such as a command to transition the UE back toa cellular network slice of the secondary operator. Using such anarrangement, a secondary operator can take advantage of capacity on acellular network slice of the cellular network operator when needed.

In the illustrated embodiment of FIG. 3 , a total of three cellularnetwork slices are presented. It should be understood that, in otherembodiments, multiple secondary operators may have cellular networkslices, there may be a greater number of cellular network slices, andthe cellular network operator and/or a secondary operator may operate adifferent number of cellular network slices. Further, the particulararchitecture of the secondary operator's network and/or cellular network110 may vary. Additionally, the components of cellular network 110 thathave communication links with components of secondary operator network211 can vary.

While various forms of entities may serve as a secondary operator, twoparticular types of entity may find such an arrangement particularlyuseful. First, a governmental entity, such as the military, may desiresignificant autonomy in operating its own virtual cellular network.Security may be of the utmost importance. Operation of its own RUs andhaving the ability to implement encryption that cannot be decrypted by acommercial operator's cellular network may be particularly useful to agovernment entity. Another type of entity that may desire significantautonomy is a casino. Casinos require a high level of surveillance todetect cheaters and illicit activity. Implementing cellular-baseddevices (as opposed to Wi-Fi based devices) may increase security.Further, by operating its own RUs, the casino may be able to furthercustomize and increase security with a decreased potential of a hackerbeing able to access information via the cellular service provider'scellular network. In such an embodiment, an LDC or NDC of the secondaryoperator may be located directly on-site at the casino and may beconnected with a DU that services one or more RU's of the casinoinstalled in the vicinity. Such arrangements may serve to benefitvarious other forms of commercial entities that require significantsecurity and/or flexibility in operating a cellular network slice.

Further, as previously detailed, such governmental and non-governmentalentities can lease or otherwise release resources (e.g., spectrum,bandwidth, processing capabilities) back to the cellular networkoperator when not needed. Alternatively, when the cellular networkoperator detects unused resources on a cellular network slice, thecellular network provider may be permitted to use such resources untilthey are needed by the secondary operator. Such an arrangement may allowa secondary operator to reserve the capability that is occasionallyneeded for a peak load, but can allow such resources to be otherwiseefficiently used when a peak load is not present.

Various methods may be performed using the embodiments of systemsdetailed in FIGS. 1-3 . FIG. 4 illustrates an embodiment of a method 400for operating a cellular network with advanced secondary operatorcontrol. Method 400 may be performed using various embodiments ofcellular network 200 or cellular network 300 of FIGS. 2 and 3 ,respectively. Method 400 can involve both a cellular network operatorand a separate and distinct secondary operator that partially relies onthe cellular network of the cellular network operator.

At block 405, a first set of one or more UE communicate with a first RUconnected with a cellular network. The first RU may be used as the radiointerface for a cellular network operator, such as to communicate withUE operated by end user customers of the cellular network operator. TheRU can communicate with the UE via one or more antennas, which wouldtypically be attached to a fixed mounting location, such as a building,tower, or bridge. Mobile locations for the RU and/or antenna may also bepossible, such as a vehicle trailer, UAV, or some other locationintended to provide temporary service to a geographic region.

At block 410, a second set of one or more UE communicate with a secondRU connected with a cellular network. The second RU may be used as theradio interface for UE of a secondary operator. This second RU may beowned, maintained, and/or operated by the secondary operator. The RU cancommunicate with the UE of the secondary operator via one or moreantennas, which may be the same or different from the antenna of block405. The second RU can be co-located with the first RU, such as housedtogether at a base station or attached with a same tower. The second RUof block 410 may operate using a same or different RAT than the firstRU. The second RU may operate using a different frequency spectrum, anoverlapping frequency spectrum, or the same frequency spectrum as thefirst RU. If overlapping or the same, only one of the RUs may use aparticular portion of frequency spectrum at a given time to avoidinterference.

At block 415, communication with the second set of UE may be controlledbased on parameters and/or characteristics set by the secondary operatorvia the secondary operator's network. The secondary operator's networkmay update these parameters and characteristics by communicating withthe second RU and UE through one or more components of the cellularnetwork provider's cellular network. Therefore, while the secondaryoperator operates its own secondary network and the second RU, thesecondary operator relies on one or more components of a cellularnetwork provider's cellular network for cellular network services and/orcommunication between the secondary network and the second RU.Parameters and characteristics that can be controlled include: themethod of authentication for UE; which UE are authenticated; thepriority of each UE; the amount of bandwidth provided to each UE; theencryption used by each UE; the cellular services provided to each UE(e.g., SMS, MMS, data services, voice services, voicemail, etc.); whichcellular network slice the UE is assigned to (if the secondary operatoroperates multiple cellular network slices); and the BWP active at eachUE. The allocation of resources to support the UE can be dynamicallyoptimized to support the required service level for each applicationsupported by the network and the UE. The policy management, enforcement,traffic shaping, packet loss, jitter, handover performance, latency,temporal and spatial service objectives can each be considered in theprovisioning and control of the communication to and from the UE. Aspart of block 415, the second RU may perform encryption and decryptionof communications from UE and to UE, respectively.

At block 420, on a first cellular network slice, communications with thefirst set of UE are performed between the cellular network and the firstset of UE using the first RU. None of these communications may beperformed using any of the components specific to the secondaryoperator, such as the second RU or the secondary operator's network. Thenetwork operator of the cellular network controls the parameters andcharacteristics set at the UE and the first RU. Similar to the secondaryoperator, the network operator can control: the priority of each UE ofthe first set; the amount of bandwidth provided to each UE; theencryption used by each UE of the first set (if any); the cellularservices provided to each UE of the first set; which cellular networkslice the UE is assigned to (if the secondary operator operates multiplecellular network slices); and the BWP active at each UE of the firstset.

At block 425, communications between the second set of UE on the secondcellular network slice of the secondary operator are routed between thesecond RU and the secondary operator's network via the cellular network.Therefore, at least one component of the cellular network provider'saccess and/or core network, such as a DU, CU, and/or NDC, is used toprocess and/or route communication traffic between the second RU and thesecondary operator's network. This communication traffic, except for aportion of the data necessary for addressing (e.g., packet headers), mayremain encrypted while on the cellular network of the cellular networkprovider. As an example, the second RU may communicate with a DU of thecellular network, which communicates with an LDC of the secondaryoperator. As another example, the second RU may communicate with a DUthat is also operated by the secondary operator. The DU of the secondaryoperator may communicate with a CU of the cellular network, whichcommunicates with an LDC or NDC of the secondary operator. The cellularnetwork operator and the cellular network may be incapable of decryptingsuch data. Rather, encryption/decryption is handled by a component ofthe secondary operator's network and either the second RU or the UE ofthe second set.

At block 430, the secondary operator's network may process thecommunications between the second set of UE handled by the second RUappropriately. Such processing can involve serving as a gateway with anetwork (e.g., the Internet, a private network) with which the UE isattempting to communicate, providing communication services (e.g., phonecalls, texts) to some other UE or device, etc. From the perspective ofthe cellular network, the precise services being provided by thesecondary operator's network to the second set of UE may not be possibleto determine, especially if the communication traffic is encrypted. Fromthe perspective of the cellular network, the bandwidth and processingresources may be physically limited in accordance with the secondcellular network slice; otherwise, the characteristics of thecommunication traffic may be unknown.

FIG. 5 illustrates an embodiment of a method 500 for operating acellular network using dynamic spectrum sharing between a secondaryoperator and a cellular network operator. Method 500 may be performedusing various embodiments of cellular network 200 or cellular network300 of FIGS. 2 and 3 , respectively. While method 500 is focused on therelease and reclamation of spectrum resources, additionally oralternatively, method 500 can be applied to access network and/or corenetwork resources reserved based on cellular network slice, such asfront-haul, mid-haul, and/or back-haul bandwidth, and/or processingresources at various components of the cellular network. Further, whilemethod 500 is focused on a secondary operator releasing resources fortemporary use by a cellular network operator, in other embodiments thesecondary operator may release resources that can be used by anothersecondary operator (e.g., one governmental entity may release resourcesto be used by another governmental entity). Method 500 can involve botha cellular network operator and a separate and distinct secondaryoperator that partially relies on the cellular network of the cellularnetwork operator.

At block 501, a determination may be made, such as by a component of thesecondary operator's network (or by an authorized user of the secondaryoperator's network) that indicates spectrum that is not currentlyneeded. This determination may be performed by an RU of the secondaryprovider or some higher-level component based on the amount of radioresources (e.g. resource blocks) used as compared to a threshold overtime. For example, if less than 50% of the available radio resources areunused for a defined period of time, a percentage of those availableradio resources may be released.

At block 505, spectrum may be released by the secondary operator'snetwork. Block 505 can include the secondary operator's networkactivating or defining new BWP definitions such that UE of the secondaryoperator do not use the spectrum that is to be released. A command maybe sent to the cellular network operator that the spectrum is availablein a particular geographic region, such as for at least a defined periodof time. It should be noted that the secondary operator may continue touse the spectrum via other RUs in other geographic regions. Forinstance, spectrum may only be released along the east coast of Florida,but may be retained by the secondary operator for use by RUs onFlorida's Gulf Coast. Only spectrum that can be utilized by UE and/or anRU of the cellular service provider may be released.

At block 510, a first RU of the cellular network operator may use thereleased spectrum to communicate with UE that are managed by thecellular network operator. Block 510 can involve updated BWP definitionsbeing sent to and/or activated by the UEs of the cellular networkoperator such that the spectrum released by the secondary operator atblock 505 can be used. Further detail of how communications performedwith the first RU may be routed are provided in relation to block 525.At block 515, a second RU of the secondary operator may use its retainedspectrum to communicate with UE that are managed by the secondaryoperator. Previously, or as part of block 515, updated BWP definitionsare sent to and/or activated by the UEs of the secondary operator suchthat the spectrum released by the secondary operator is not attempted tobe used. Further detail of how communications performed with the secondRU may be routed are provided in relation to block 530.

At block 520, spectrum that was released or leased at block 505 may bereclaimed or the lease may not be renewed. Block 520 may be performedbased on a step similar to block 501 being performed in which thedetermination reaches the opposite conclusion in that some amount ofreserved spectrum is now needed. Again here, the determination could bebased on a comparison to a threshold over time. For instance, if morethan 75% of the available spectrum of the second RU is used on averagefor over a defined period of time, spectrum that was previously releasedmay be reclaimed (or a lease may not be renewed). As part of block 520,the cellular network operator may send new or activate different BWPdefinitions at its UE so that the bandwidth is no longer used. Thesecondary operator, via its RU, may send new or activate different BWPdefinitions at its UE so that the reclaimed spectrum begins being used.

At block 525, on a first cellular network slice, communications with thefirst set of UE are performed between the cellular network and the firstset of UE using the first RU. None of these communications may beperformed using any of the components specific to the secondaryoperator, such as the second RU or the secondary operator's network. Thenetwork operator of the cellular network controls the parameters andcharacteristics set at the UE and the first RU. Similar to the secondaryoperator, the network operator can control: the priority of each UE ofthe first set; the amount of bandwidth provided to each UE; theencryption used by each UE of the first set (if any); the cellularservices provided to each UE of the first set; which cellular networkslice the UE is assigned to (if the secondary operator operates multiplecellular network slices); and the BWP active at each UE of the firstset.

At block 530, communications between the second set of UE on the secondcellular network slice of the secondary operator are routed between thesecond RU and the secondary operator's network via the access networkand/or core network. Therefore, at least one component of the cellularnetwork provider's cellular access network and/or cellular core network,such as a DU, CU, and/or NDC, is used to process and/or routecommunication traffic between the second RU and the secondary operator'snetwork. This communication traffic, except for a portion of the datanecessary for addressing (e.g., packet headers), may remain encryptedwhile on the cellular network of the cellular network provider. As anexample, the second RU may communicate with a DU of the cellularnetwork, which communicates with an LDC of the secondary operator. Asanother example, the second RU may communicate with a DU that is alsooperated by the secondary operator. The DU of the secondary operator maycommunicate with a CU of the cellular network, which communicates withan LDC or NDC of the secondary operator. The cellular network operatorand the cellular network may be incapable of decrypting such data.Rather, encryption/decryption is handled by a component of the secondaryoperator's network and either the second RU or the UE of the second set.

At block 535, the secondary operator's network may process thecommunications between the second set of UE handled by the second RUappropriately. Such processing can involve serving as a gateway with anetwork (e.g., the Internet, a private network) with which the UE isattempting to communicate, providing communication services (e.g., phonecalls, texts) to some other UE or device, etc. From the perspective ofthe cellular network, the precise services being provided by thesecondary operator's network to the second set of UE may not be possibleto determine, especially if the communication traffic is encrypted. Fromthe perspective of the cellular network, the bandwidth and processingresources may be physically limited in accordance with the secondcellular network slice; otherwise, the characteristics of thecommunication traffic may be unknown.

FIG. 6 illustrates an embodiment of a method 600 for operating acellular network with advanced secondary operator control on multiplecellular network slices. Method 600 may be performed using variousembodiments of cellular network 300 of FIG. 3 .

At block 605, a first set of one or more UE communicate with a first RUconnected with a cellular network of a cellular network. The first RUmay be used as the radio interface for a cellular network operator, suchas to communicate with UE operated by end user customers of the cellularnetwork operator. The RU can communicate with the UE via one or moreantennas, which would typically be attached to a fixed mountinglocation, such as a building, tower, or bridge. Mobile locations for theRU and/or antenna may also be possible, such as a vehicle trailer, UAV,or some other location intended to provide temporary service to ageographic region.

At block 610, a second set of one or more UE communicates with a secondRU connected with a cellular network. The second RU may be used as theradio interface for UE of a secondary operator. The RU can communicatewith the UE of the secondary operator via one or more antennas, whichmay be the same or different from the antenna of block 605. The secondRU can be co-located with the first RU, such as housed together at abase station or attached with a same tower. The second RU of block 610may operate using a same or different RAT than the first RU. The secondRU may operate using a different frequency spectrum, an overlappingfrequency spectrum, or the same frequency spectrum as the first RU. Ifoverlapping or the same, only one of the RUs may use a particularportion of frequency spectrum at a given time to avoid interference.

At block 615, a third set of one or more UE communicates with the secondRU or a third RU connected with a cellular network. If present, thethird RU may be used as the radio interface for some UE of the secondaryoperator in addition to the second RU. The second RU and/or third RU cancommunicate with additional UE (the third set) of the secondary operatorvia one or more antennas, which may be the same or different from theantenna of block 605 and block 610. The third RU, if present, can beco-located with the first and second RU, such as housed together at abase station or attached with a same tower. The third RU of block 615may operate using a same or different RAT than the first RU and/orsecond RU. The third RU may operate using a different frequencyspectrum, an overlapping frequency spectrum, or the same frequencyspectrum as the second RU and/or third RU.

At block 620, communication with the second set of UE and third set ofUE may be controlled based on parameters and characteristics set by thesecondary operator via the secondary operator's network. The parametersand characteristics set for the second and third sets of UE can vary percellular network slice. The secondary operator's network may updatethese parameters and characteristics by communicating with the second RU(and third RU, if present) and UE through one or more components of thecellular network provider's cellular network. Therefore, while thesecondary operator operates its own secondary network and one or moreRUs, the secondary operator relies on one or more components of thecellular network provider's cellular network for cellular networkservices and/or communication between the secondary network and thesecond and, possibly, third RU. Parameters and characteristics that canbe controlled include: the priority of each UE; the amount of bandwidthprovided to each UE; the encryption used by each UE; the cellularservices provided to each UE; which cellular network slice the UE isassigned to (if the secondary operator operates multiple cellularnetwork slices); and the BWP active at each UE.

At block 625, on the first cellular network slice, communications withthe first set of UE are performed between the cellular network and thefirst RU for the first set of UE. None of these communications may beperformed using any of the components specific to the secondaryoperator, such as the second RU, third RU, or the secondary operator'snetwork. The network operator of the cellular network controls theparameters and characteristics set at the UE and the first RU. Similarto the secondary operator, the network operator can control: thepriority of each UE of the first set; the amount of bandwidth providedto each UE; the encryption used by each UE of the first set (if any);the cellular services provided to each UE of the first set; whichcellular network slice the UE is assigned to (if the secondary operatoroperates multiple cellular network slices); and the BWP active at eachUE of the first set.

At block 630, communications between the second set of UE of thesecondary operator are routed between the second RU and the secondaryoperator's network via the cellular network as part of the secondcellular network slice. Therefore, at least one component of thecellular network provider's access network and/or core network, such asa DU, CU, and/or NDC, is used to process and/or route communicationtraffic between the second RU and the secondary operator's network. Thiscommunication traffic, except for a portion of the data necessary foraddressing (e.g., packet headers), may remain encrypted while on thecellular network of the cellular network provider. The cellular networkoperator and the cellular network may be incapable of decrypting suchdata. Rather, encryption/decryption is handled by a component of thesecondary operator's network and either the second RU or the UE of thesecond set.

At block 635, communications between the third set of UE of thesecondary operator are routed between the second (or third) RU and thesecondary operator's network via the access network and/or core cellularnetwork as part of the third cellular network slice. At least one aspectof the communication traffic of the third cellular network slice may behandled differently than the second cellular network slice. In someembodiments, the routing between the cellular network and the secondaryoperator's network varies, such as the differences indicated by arrows245 and 345. Additional or alternatively, other parameters orcharacteristics may vary, such as the total amount of bandwidth orprocessing resources of the slices, the available cellular services, thetype of encryption used (if any), etc. Additionally or alternatively,the third slice may serve a purpose other than different routing. Forexample, the third slice could be used as a test environment fordifferent security functionality.

At block 640, the secondary operator's network may receive and processthe communications between the second and third sets of UE handled bythe second (and, if present, third) RU appropriately. Such processingcan involve serving as a gateway with a network (e.g., the Internet, aprivate network) with which the UE is attempting to communicate,providing communication services (e.g., phone calls, texts) to someother UE or device, etc. From the perspective of the cellular network,the precise services being provided by the secondary operator's networkto the second set of UE may not be possible to determine, especially ifthe communication traffic is encrypted. From the perspective of thecellular network, the bandwidth and processing resources may bephysically limited in accordance with the allocation of the second andthird cellular network slices; otherwise, the characteristics of thecommunication traffic may be unknown.

The methods, systems, and devices discussed above are examples. Variousconfigurations may omit, substitute, or add various procedures orcomponents as appropriate. For instance, in alternative configurations,the methods may be performed in an order different from that described,and/or various stages may be added, omitted, and/or combined. Also,features described with respect to certain configurations may becombined in various other configurations. Different aspects and elementsof the configurations may be combined in a similar manner. Also,technology evolves and, thus, many of the elements are examples and donot limit the scope of the disclosure or claims.

Specific details are given in the description to provide a thoroughunderstanding of example configurations (including implementations).However, configurations may be practiced without these specific details.For example, well-known circuits, processes, algorithms, structures, andtechniques have been shown without unnecessary detail in order to avoidobscuring the configurations. This description provides exampleconfigurations only, and does not limit the scope, applicability, orconfigurations of the claims. Rather, the preceding description of theconfigurations will provide those skilled in the art with an enablingdescription for implementing described techniques. Various changes maybe made in the function and arrangement of elements without departingfrom the spirit or scope of the disclosure.

Also, configurations may be described as a process which is depicted asa flow diagram or block diagram. Although each may describe theoperations as a sequential process, many of the operations can beperformed in parallel or concurrently. In addition, the order of theoperations may be rearranged. A process may have additional steps notincluded in the figure. Furthermore, examples of the methods may beimplemented by hardware, software, firmware, middleware, microcode,hardware description languages, or any combination thereof. Whenimplemented in software, firmware, middleware, or microcode, the programcode or code segments to perform the necessary tasks may be stored in anon-transitory computer-readable medium such as a storage medium.Processors may perform the described tasks.

Having described several example configurations, various modifications,alternative constructions, and equivalents may be used without departingfrom the spirit of the disclosure. For example, the above elements maybe components of a larger system, wherein other rules may takeprecedence over or otherwise modify the application of the invention.Also, a number of steps may be undertaken before, during, or after theabove elements are considered.

What is claimed is:
 1. A cellular network with advanced secondaryoperator privacy, the cellular network comprising: a first radio unitthat communicates with a first plurality of user equipment using a firstradio spectrum, wherein: first communications between the first radiounit and the cellular network are performed as part of a first cellularnetwork slice; and the first radio unit is operated by a cellularnetwork operator; a second radio unit that communicates with a secondplurality of user equipment using a second radio spectrum, wherein: thesecond radio unit is operated by a secondary operator distinct from thecellular network operator; second communications between the secondradio unit and the cellular network are performed as part of a secondcellular network slice; and the second radio unit encrypts the secondcommunications such that the cellular network cannot decrypt the secondcommunications; a distributed unit (DU) of a cellular access networkthat is in communication with the first radio unit and the second radiounit, wherein the DU is operated by the cellular network operator,wherein: the DU routes the first communications and the secondcommunications to a centralized unit (CU) of the cellular network,wherein the CU is operated by the cellular network operator; and the CUroutes the second communications to a data center of the secondaryoperator that is separate and distinct from the cellular network; andthe cellular access network of the cellular network that routes thesecond communications performed as part of the second cellular networkslice as encrypted by the second radio unit to the data center.
 2. Thecellular network with the advanced secondary operator privacy of claim1, wherein the second radio unit further sends third communicationsbetween the second radio unit and the cellular network as part of athird cellular network slice.
 3. The cellular network with the advancedsecondary operator privacy of claim 2, wherein the cellular networkroutes the second communications and the third communications toseparate components of a same network that is distinct from the cellularnetwork and operated by the secondary operator.
 4. A cellular networkwith advanced secondary operator privacy, the cellular networkcomprising: a first radio unit that communicates with a first pluralityof user equipment using a first radio spectrum, wherein: firstcommunications between the first radio unit and the cellular network areperformed as part of a first cellular network slice; and the first radiounit is operated by a cellular network operator; a second radio unitthat communicates with a second plurality of user equipment using asecond radio spectrum, wherein: the second radio unit is operated by asecondary operator distinct from the cellular network operator; secondcommunications between the second radio unit and the cellular networkare performed as part of a second cellular network slice; and the secondradio unit encrypts the second communications such that the cellularnetwork cannot decrypt the second communications; and a distributed unit(DU) of a cellular access network that is in communication with thefirst radio unit and the second radio unit, wherein the DU is operatedby the cellular network operator, wherein: the DU routes the firstcommunications to a centralized unit (CU) of the cellular networkoperated by the cellular network operator and the second communicationsto a data center that is operated by the secondary operator and isseparate from the cellular network.
 5. The cellular network with theadvanced secondary operator privacy of claim 1, wherein the cellularnetwork comprises a 5G New Radio (NR) cellular core network.
 6. Thecellular network with the advanced secondary operator privacy of claim1, further comprising user equipment of the second plurality of userequipment, wherein the user equipment of the second plurality of userequipment is configured to be switched between communicating with thefirst radio unit and the second radio unit based on a command.
 7. Thecellular network with the advanced secondary operator privacy of claim1, wherein the first radio unit uses a different cellular network radioaccess technology (RAT) for communication with the first plurality ofuser equipment than the second radio unit with the second plurality ofuser equipment.
 8. A method for operating a cellular network withadvanced secondary operator privacy, the method comprising:communicating with a first set of user equipment using a first radiounit and a first radio spectrum, wherein: first communications betweenthe first radio unit and the cellular network are performed as part of afirst cellular network slice; and the first radio unit is operated by acellular network operator; communicating with a second set of userequipment using a second radio unit and a second radio spectrum,wherein: the second radio unit is operated by a secondary operatordistinct from the cellular network operator; second communicationsbetween the second radio unit and the cellular network are performed aspart of a second cellular network slice; the second radio unit encryptsthe second communications such that the cellular network cannot decryptthe second communications; routing, by a distributed unit (DU), thefirst communications and the encrypted second communications to acentralized unit (CU) of the cellular network, wherein the CU isoperated by the cellular network operator; and routing, by the CU of thecellular network, the encrypted second communications of the secondcellular network slice from the second radio unit to a data centeroperated by the secondary operator, wherein the data center is separatefrom the cellular network.
 9. The method for operating the cellularnetwork with advanced secondary operator privacy of claim 8, furthercomprising: sending, by the second radio unit, third communications aspart of a third cellular network slice on the cellular network.
 10. Themethod for operating the cellular network with advanced secondaryoperator privacy of claim 9, further comprising: routing, by thecellular network, the second communications and the third communicationsto separate components of a same network that is distinct from thecellular network and operated by the secondary operator.
 11. A methodfor operating a cellular network with advanced secondary operatorprivacy, the method comprising: communicating with a first set of userequipment using a first radio unit and a first radio spectrum, wherein:first communications between the first radio unit and the cellularnetwork are performed as part of a first cellular network slice; and thefirst radio unit is operated by a cellular network operator;communicating with a second set of user equipment using a second radiounit and a second radio spectrum, wherein: the second radio unit isoperated by a secondary operator distinct from the cellular networkoperator; second communications between the second radio unit and thecellular network are performed as part of a second cellular networkslice; and the second radio unit encrypts the second communications suchthat the cellular network cannot decrypt the second communications; androuting, by a distributed unit (DU), the first communications to acentralized unit (CU) of the cellular network operated by the cellularnetwork operator and the second communications to a data center that isoperated by the secondary operator and is separate from the cellularnetwork.
 12. The method for operating the cellular network with advancedsecondary operator privacy of claim 8, wherein the cellular network is a5G New Radio (NR) cellular network.
 13. The method for operating thecellular network with advanced secondary operator privacy of claim 8,further comprising: switching, by user equipment of the second set ofuser equipment, between communicating with the first radio unit and thesecond radio unit based on a command.
 14. The method for operating thecellular network with advanced secondary operator privacy of claim 8,wherein the first radio unit uses a different cellular network radioaccess technology (RAT) for communication with the first set of userequipment than the second radio unit with the second set of userequipment.